AMENDMENTS TO THE CLAIMS 



Without prejudice, please amend the claims as reflected in the following listing 
of claims, which wilt replace all prior versions, and listings, of claims in the 
application: 



Listing of Claims: 



1. (Original) A method of detecting bandwidth anomalies in a data 
communication system, the method comprising: 

receiving a first traffic waveform representing a time distribution 
of data volume in a first direction in said data communication 
system in a first period of time; 

producing a correlation value representing a correlation of said 
first traffic waveform with a reference waveform; and 

producing a bandwidth anomaly signal when said correlation 
value satisfies a criterion. 

2. (Currently Amended) The method of claim 1 wherein producing 
said bandwidth anomaly signal comprises producing sa\4 a denial of 
service attack signal when said correlation value is less than a 
reference value. 

3. (Original) The method of claim 2 wherein producing said bandwidth 
anomaly signal comprises determining whether said correlation value is 
less than said reference value. 

4. (Original) The method of claim 1 further comprising receiving a 
second traffic waveform representing a time distribution of data volume 
in a second direction on said data communication system in a second 
period of time, and using said second traffic waveform as said 
reference waveform to produce said correlation value. 

5. (Original) The method of claim 1 further comprising generating said 
first traffic waveform in response to a first set of traffic measurement 
values. 

6. (Original) The method of claim 5 wherein generating said first traffic 
waveform comprises subjecting said first set of traffic measurement 
values to a Discrete Wavelet Transform. 
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7. (Original) The method of claim 6 wherein subjecting said first set of 
traffic measurement values to said Discrete Wavelet Transform 
comprises using Haar wavelet filter coefficients in said Discrete 
Wavelet Transform. 

8. (Original) The method of claim 6 wherein generating said first traffic 
waveform comprises causing said Discrete Wavelet Transform to 
produce a first component, said first component representing said first 
traffic waveform. 

9. (Original) The method of claim 8 wherein producing said correlation 
value comprises correlating said first component with said reference 
waveform. 

10. (Original) The method of claim 8 further comprising using a 
processor circuit to generate said first traffic waveform and to correlate 
said first traffic waveform with said reference waveform. 

11. (Original) The method of claim 1 wherein said first traffic waveform 
represents a statistical measure of a time distribution of data volume in 
said first direction. 

12. (Original) The method of claim 5 further comprising monitoring data 
in said first direction and producing said first set of traffic measurement 
values in response thereto. 

13. (Original) The method of claim 12 wherein producing said first set 
of traffic measurement values comprises producing values 
representing a property of an Ethernet statistics group in a remote 
monitoring protocol. 

14. (Original) The method of claim 13 further comprising causing a 
processor circuit operable to produce said first traffic waveform to 
communicate with a communication interface to receive said values 
representing said property of an Ethernet statistics group. 

15. (Original) The method of claim 12 wherein monitoring said data in 
said first direction comprises at least one of: counting packets and 
counting octets, in said first direction. 

16. (Original) The method of claim 15 further comprising causing a 
processor circuit operable to produce said first traffic waveform to 
communicate with at least one of a packet counter and an octet 
counter to receive values representing said first set of traffic 
measurement values. 
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17. (Original) The method of claim 16 further comprising causing said 
processor circuit to implement at least one of said packet counter and 
said octet counter. 

18. (Original) The method of claim 12 further comprising passively 
monitoring said data in said first direction. 

19. (Original) A data communication method comprising transmitting 
and receiving data from a data communication system, the data 
communication system method of claim 12 and further comprising 
signaling an operator in response to said bandwidth anomaly signal. 

20. (Original) A data communication method comprising transmitting 
and receiving data from a data communication system, the data 
communication system method of claim 12 and further comprising 
controlling at least one of transmission and reception of data from said 
data communication system in response to said bandwidth anomaly 
signal. 

21 . (Original) The method of claim 4 further comprising generating said 
first and second traffic waveforms in response to first and second sets 
of traffic measurement values, representing traffic in said first and 
second directions on said data communication system, respectively. 

22. (Original) The method of claim 21 wherein receiving said first and 
second traffic waveforms comprises receiving first and second 
waveforms representing first and second statistical measures of first 
and second time distributions respectively of data volume in first and 
second directions in said data communications system. 

23. (Original) The method of claim 21 wherein generating said first and 
second traffic waveforms comprises subjecting said first and second 
sets of traffic measurement values respectively, to a Discrete Wavelet 
Transform. 

24. (Original) The method of claim 23 wherein subjecting said first and 
second sets of traffic measurement values to said Discrete Wavelet 
Transform comprises using Haar wavelet filter, coefficients in said 
Discrete Wavelet Transform. 

25. (Original) The method of claim 23 further comprising causing said 
Discrete Wavelet Transform to produce a first component, representing 
said first traffic waveform and a second component representing said 
second traffic waveform. 

26. (Original) The method of claim 25 wherein producing said 
correlation value comprises correlating said first and second 
components. 
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27. (Original) The method of claim 25 further comprising implementing 
a traffic waveform generator in a processor circuit used to produce said 
correlation value. 

28. (Original) The method of claim 21 further comprising monitoring 
data in said first and second directions and producing said first and 
second sets of traffic measurement values respectively in response 
thereto. 

29. (Original) The method of claim 28 wherein producing said first and 
second sets of traffic measurement values comprises producing values 
representing a property of an Ethernet statistics group in a remote 
monitoring protocol, for each of said first and second directions. 

30. (Original) The method of claim 29 further comprising causing a 
processor circuit operable to produce said first and second traffic 
waveforms to communicate with a communication interface to receive 
said values representing a property of an Ethernet statistics group. 

31. (Original) The method of claim 28 wherein monitoring said data 
comprises at least one of: packet counters and octet counters in each 
of said first and second directions. 

32. (Original) The method of claim 28 further comprising causing a 
processor circuit operable to produce said first and second traffic 
waveforms to communicate with at least one of a packet counter and 
an octet counter to receive values representing said first and second 
sets of traffic measurement values. 

33. (Original) The method of claim 32 further comprising causing said 
processor circuit to implement at least one of said packet counter and 
said octet counter. 

34. (Original) The method of claim 28 further comprising passively 
monitoring said data in said first and second directions. 

35. (Original) A data communication method comprising transmitting 
and receiving data from a data communication system, the data 
communication method of claim 1 and further comprising signaling an 
operator in response to said bandwidth anomaly signal. 

36. (Original) A data communication method comprising transmitting 
and receiving data from a data communication system, the data 
communication method of claim 1 and further comprising controlling at 
least one of the transmission and reception of data from said data 
communication system in response to said bandwidth anomaly signal. 
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37. (Original) An apparatus for detecting bandwidth anomalies in a data 
communication system, the apparatus comprising: 

means for receiving a first traffic waveform representing a time 
distribution of data volume in a first direction in said data 
communication system in a first period of time; 
means for producing a correlation value representing a 
correlation of said first traffic waveform with a reference 
waveform; and 

means for producing a bandwidth anomaly signal when said 
correlation value satisfies a criterion. 

38. (Currently Amended) A computer readable medium encoded with 
computer executable instructions cod e s for directing a processor circuit 
to detect bandwidth anomalies in a data communication system, by the 
instructions comprising : 

instructions for causing the processor circuit to receiveme a first 
traffic waveform representing a time distribution of data volume 
in a first direction in said data communication system in a first 
period of time; 

instructions for causing the processor circuit to producem§ a 
correlation value representing a correlation of said first traffic 
waveform with a reference waveform; and 

instructions for causing the processor circuit to producem§ a 
bandwidth anomaly signal when said correlation value satisfies 
a criterion. 

39. (Currently Amended) A computer readable signal encoded with 
computer executable instructions codes for directing a processor circuit 
to detect bandwidth anomalies in a data communication system, by the 
instructions comprising : 

instructions for causing the processor circuit to receivem§ a first 
traffic waveform representing a time distribution of data volume 
in a first direction in said data communication system in a first 
period of time; 

instructions for causing the processor circuit to produceing a 
correlation value representing a correlation of said first traffic 
waveform with a reference waveform; and 

instructions for causing the processor circuit to producem§ a 
bandwidth anomaly signal when said correlation value satisfies 
a criterion. 
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40. (Original) An apparatus for detecting bandwidth anomalies in a data 
communication system, the apparatus comprising: 

a processor circuit configured to: 

receive a first traffic waveform representing a time distribution of 
data volume in a first direction in said data communication 
system in a first period of time; 

produce a correlation value representing a correlation of said 
first traffic waveform with a reference waveform; and 

produce a bandwidth anomaly signal when said correlation 
value satisfies a criterion. 

41 . (Original) The apparatus of claim 40 wherein said processor circuit 
is configured to produce said bandwidth anomaly signal when said 
correlation value is less than a reference value. 

42. (Original) The apparatus of claim 41 wherein said processor circuit 
is configured to determine whether said correlation value is less than 
said reference value. 

43. (Original) The apparatus of claim 40 wherein said processor circuit 
is configured to receive a second traffic waveform representing a 
statistical measure of a time distribution of data volume in a second 
direction on said data communication system in a second period of 
time, and use said second traffic waveform as said reference waveform 
to produce said correlation value. 

44. (Original) The apparatus of claim 40 further comprising a first traffic 
waveform generator operable to receive a first set of traffic 
measurement values and to produce said first traffic waveform in 
response thereto. 

45. (Original) The apparatus of claim 44 wherein said first traffic 
waveform generator is configured to produce said first traffic waveform 
by subjecting said first set of traffic measurement values to a Discrete 
Wavelet Transform. 

46. (Original) The apparatus of claim 45 wherein said first traffic 
waveform generator is configured to use Haar wavelet filter coefficients 
in said Discrete Wavelet Transform. 

47. (Original) The apparatus of claim 45 wherein said first traffic 
waveform generator is configured to cause said Discrete Wavelet 
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Transform to produce a first component, said first component 
representing said first traffic waveform. 

48. (Original) The apparatus of claim 47 wherein said processor circuit 
is configured to produce said correlation value by correlating said first 
component with said reference waveform. 

49. (Original) The apparatus of claim 44 wherein said processor circuit 
is configured to implement said first traffic waveform generator. 

50. (Original) The apparatus of claim 40 wherein said first traffic 
waveform represents a statistical measure of a time distribution of data 
volume in said first direction. 

51. (Original) The apparatus of claim 44 further comprising a 
communication interface operable to monitor data in said first direction 
and to produce said first set of traffic measurement values in response 
thereto. 

52. (Original) The apparatus of claim 51 wherein said communication 
interface produces values representing a property of an Ethernet 
statistics group in a remote monitoring protocol. 

53. (Original) The apparatus of claim 52 wherein said processor circuit 
is configured to communicate with said communication interface to 
receive said values representing a property of an Ethernet statistics 
group, said values representing said first set of traffic measurement 
values. 

54. (Original) The apparatus of claim 51 wherein said communication 
interface includes at least one of a packet counter and an octet counter 
operable to count a corresponding one of packets and octets of data in 
said first direction. 

55. (Original) The apparatus of claim 54 wherein said processor circuit 
is configured to communicate with said communication interface to 
receive values produced by at least one of a said packet counter and 
said octet counter, said values representing said first set of traffic 
measurement values. 

56. (Original) The apparatus of claim 55 wherein said processor circuit 
is configured to implement said communication interface. 

57. (Original) The apparatus of claim 51 further comprising a passive 
monitor operable to passively monitor said data in said first direction 
and to provide a copy of said data in said first direction to said 
communication interface. 
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58. (Original) A data communication apparatus operable to transmit 
and receive data from a data communication system, the data 
communication apparatus comprising the apparatus of claim 51 and 
further comprising a signaling device for signaling an operator in 
response to said bandwidth anomaly signal. 

59. (Original) A data communication apparatus operable to transmit 
and receive data from a data communication system, the data 
communication apparatus comprising the apparatus of claim 51 and 
further comprising a communication control device for controlling at 
least one of the transmission and reception of data from said data 
communication system in response to said bandwidth anomaly signal. 

60. (Currently Amended) The apparatus of claim 43 further 
comprising a traffic waveform generator operable to receive said first 
and second sets of traffic measurement values and to produce said 
first and second traffic waveforms in response thereto. 

61. (Original) The apparatus of claim 60 wherein said processor is 
configured to receive first and second traffic waveforms representing 
first and second statistical measures of first and second time 
distributions respectively of data volume in first and second directions 
in said data communications system. 

62. (Original) The apparatus of claim 60 wherein said traffic waveform 
generator is configured to produce said first and second traffic 
waveforms by subjecting said first and second sets of traffic 
measurement values respectively, to a Discrete Wavelet Transform. 

63. (Original) The apparatus of claim 62 wherein said traffic waveform 
generator is configured to use Haar wavelet filter coefficients in said 
Discrete Wavelet Transform. 

64. (Original) The apparatus of claim 62 wherein said traffic waveform 
generator is configured to cause said Discrete Wavelet Transform to 
produce a first component, representing said first traffic waveform and 
a second component representing said second traffic waveform. 

65. (Original) The apparatus of claim 64 wherein said processor circuit 
is configured to produce said correlation value by correlating said first 
and second components. 

66. (Original) The apparatus of claim 64 wherein said processor circuit 
is configured to implement said traffic waveform generator. 

67. (Original) The apparatus of claim 60 further comprising a 
communication interface operable to monitor data in said first and 
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second directions and to produce said first and second sets of traffic 
measurement values respectively in response thereto. 

68. (Original) The apparatus of claim 67 wherein said communication 
interface produces values representing a property of an Ethernet 
statistics group in a remote monitoring protocol, for each of said first 
and second directions. 

69. (Original) The apparatus of claim 68 wherein said processor circuit 
is configured to communicate with said communication interface to 
receive said values representing a property of an Ethernet statistics 
group, for each of said first and second directions, said values 
representing said first and second sets of traffic measurement values 
respectively. 

70. (Original) The apparatus of claim 67 wherein said communication 
interface includes at least one of a packet counter and an octet counter 
operable to count a corresponding one of packets and octets of data 
for each of said first and second directions. 

71. (Currently Amended) The apparatus of claim 67 70 wherein said 
processor circuit is configured to communicate with said 
communication interface to receive values produced by at least one of 
said packet counter and said octet counter, said values representing 
said first and second sets of traffic measurement values. 

72. (Original) The apparatus of claim 67 wherein said processor circuit 
is configured to implement said communication interface. 

73. (Original) The apparatus of claim 67 further comprising a passive 
monitor operable to passively monitor said data in said first and second 
directions and to provide copies of said data to said communication 
interface. 

74. (Original) A data communication apparatus operable to transmit 
and receive data from a data communication system, the data 
communication apparatus comprising the apparatus of claim 40 and 
further comprising a signaling device for signaling an operator in 
response to said bandwidth anomaly signal. 

75. (Original) A data communication apparatus operable to transmit 
and receive data from a data communication system, the data 
communication apparatus comprising the apparatus of claim 40 and 
further comprising a communication control device for controlling at 
least one of the transmission and reception of data from said data 
communication system in response to said bandwidth anomaly signal. 
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